Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10/07/2024, 10:50
General
-
Target
2024-07-10_fe7231a242fb52dedbce25759f0308c1_magniber.exe
-
Size
6.6MB
-
MD5
fe7231a242fb52dedbce25759f0308c1
-
SHA1
44130fffa288481c403c7973366a1f78315b7125
-
SHA256
2f995ebebc555e7f5b49347cd529c78756bb45c2554d79b31d664a73d5f4cabf
-
SHA512
1043d23e4da56b49e1bc1553947d35ea18fa92f802c1d36fe72c1087a56f410ebea7fe5e09da96c9abd2a1c690f40920099aeb9eda91a1a40baaeac4d2952dc3
-
SSDEEP
49152:Gwi0L0qX2B8NIMI8Sfpwotkzaawi0L0qX2B8NIMI8Sfpwotkza4:Ji0tTIMzKpXOui0tTIMzKpXOH
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_fe7231a242fb52dedbce25759f0308c1_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_fe7231a242fb52dedbce25759f0308c1_magniber.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5710ce31200fa9a4a215a9fd1294f779d
SHA118472faf4bc44669ce266e65bcc2ea952ba68f67
SHA256c821335303a83f0e1251e6c5286ad34a3a6623454545f9ecd449d49d80111889
SHA5123e654f6e87fd1632b6c422f1bbf14e5cf8294fb753dce6c2cf5d2864981c1d17df6588d2a3b11dbc2ab4e37f350d86834c92b7b9ecfbadd1312bb6af6ad577b5
-
Filesize
1KB
MD5b48529e9ce647de17dbbfc62f2f77233
SHA1215285e0b5f8dbeb8c5fcc3c2a465c82b537bcc3
SHA2560e785accdbd147189eabd5987a30559a03be7b6d749771b53998e542b67ba49b
SHA51279fb83a3a5bb443af73f9dc114a1bc94cce873347ff2a7853ff2266323bcc74fbe2b4620644264d8150a011e0f1708dc12edcd3c4d04ba07474f662167613c6f
-
Filesize
950B
MD51daaabc9fd32e0cfd9fa450d836ca97f
SHA1cfb4bb0359a42151468f0f952696560e12dd95f4
SHA256c67f5e294347c6549be6bbea0090d41c5644cef17061462025ec97e087304d30
SHA5125e82c9efb44cdebd49265072e0772c20552753d0349f65f79100df9b7c6f7925982cc0c1044435b67f9461e0782c2cf6adf24c70f846f5a889176fcc7d08c2e4
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
6.6MB
MD5fe7231a242fb52dedbce25759f0308c1
SHA144130fffa288481c403c7973366a1f78315b7125
SHA2562f995ebebc555e7f5b49347cd529c78756bb45c2554d79b31d664a73d5f4cabf
SHA5121043d23e4da56b49e1bc1553947d35ea18fa92f802c1d36fe72c1087a56f410ebea7fe5e09da96c9abd2a1c690f40920099aeb9eda91a1a40baaeac4d2952dc3
-
Filesize
6.6MB
MD5b1ddde00512892b55adaadb1a4b5d773
SHA13af2e9f96bb015bde2eecb481c9b6223c952e0d4
SHA256207c81da947b0cc80bff44e4f7dc15f52142c6b416906ad588b567e975986e02
SHA512fc6264ab8e9e63171c424781def30b533fc4e12d1ec02e719a35dd7741381355cc8985d9fecdc372ff10795caa10ae93ead1fb0e24fe92afc0ecc57c90574bfc
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB